Updating `ca-bundle.crt` to be able to build requires up-to-date `ca-bundle.crt`

Help
1

Welp: I am locked out of updating my machine…

nixos-rebuild switch --flake .#my-sad-machine
[...]
error: unable to download 'https://cache.nixos.org/nar/1v09jszprqkblf7ns99hp45rph5d6lsr5zyfxkx2m7n087q2rg9l.nar.zst': error adding trust anchors from file: /etc/ssl/certs/ca-certificates.crt (curl error code=77)
[... and mooooore...]

I haven’t updated this in a few days… Therefore, the trusted certificates list still shows the now infamous:

rg Comodo /etc/static/ssl/certs/ca-bundle.crt 
1759:Comodo AAA Services root

I am assuming that it is causing trouble.

If I copy the file, edit it manually, then set CURL_CA_BUNDLE, and NIX_SSL_CERT_FILE… it seems that it is useless because of SSL certificate path does not propagate to builds during `nix-build` · Issue #10783 · NixOS/nix · GitHub .
Rebuilding (seems to) need an up-to-date ca-bundle, but updating the ca-bundle requires rebuilding… :chicken: :egg:
Am I check mate?

2

At worst there’s always nixos-install (see point 5 of the manual) from something else ?

(Given your discourse flare, I assume you already know this, but might be useful to onlookers)

3

I don’t think any of the mitigations that were done would result in this, so a little confused. cc @hexa :eyes:

4

Yeah, that seems unrelated to any of the ca-bundle changes we did recently.

I would recommend running nix-store --verify --repair, possibly even with --check-contents to rule out corruption.

5

At worst there’s always nixos-install (see point 5 of the manual) from something else ?

Yes, that was my last resort action.

A bit tedious, and not the “self-recovery” I hoped to be able to achieve.

6

Thanks @winter @hexa for jumping in.

In the end, I was able to unstuck myself by using another computer to build the system and copy the closure over SSH. After that, local builds worked fine.

For good measures, I ran

nix-store --verify --repair
nix-store --verify --repair --check-contents

which showed a bunch of:

path '/nix/store/037ni430ab9p42cplg3r3nwzgapalj17-python3.13-gssapi-1.10.1' disappeared, removing from database...
[... and many more...]

path '/nix/store/06v5dnvy7xfij23qywdiv9ilv559ija6-svelte-language-server-0.17.31' was modified! expected hash 'sha256-aWii1cn4uJoeEFxRuLPwwyYLz3nhmBcVFXcXERmBAnk=', got 'sha256-bx+aASSKs/FmOkuwDgL44en4aUlwlP6FIMrJBxk8sLw='
copying path '/nix/store/06v5dnvy7xfij23qywdiv9ilv559ija6-svelte-language-server-0.17.31' from 'https://cache.nixos.org'..
[... and many more...]

In the end, not exactly sure what happened, but it seems that I got back into a usable state :crossed_fingers:

7

Edit: Missed the second part of the theat. OP already went the route I was about to suggest.